C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
3708 commits 17 branches 66 tags 141 MiB
Commit graph

2350 commits

Author SHA1 Message Date
Erwan Miran
1432e511a2 same work with less lines 2018-08-24 14:06:07 +02:00
Vasilis Remmas
b61eb7d7f3 Add ETCD_QUOTA_BACKEND_BYTES environment variable 2018-08-24 12:17:34 +02:00
Aivars Sterns
1567a977c3
Revert "gen_certs_script: refactor using stdin (Ansible 2.4+)" 2018-08-24 12:35:31 +03:00
Samuele Chiocca
cb8be37f72 fix on v1alpha1 2018-08-24 11:19:06 +02:00
Samuele Chiocca
e5dd4e1e70 added on v1alpha1 2018-08-24 10:59:06 +02:00
Antoine Legrand
6d74a3db7a
Merge pull request #3163 from kubernetes-incubator/fix-docker-ubuntu1804 
Fix docker apt-repo for Ubuntu18
 2018-08-24 00:51:59 +02:00
ant31
1da5926a94 Use xenial repo for ubuntu18 2018-08-23 22:34:44 +00:00
Antoine Legrand
4882531c29
Merge pull request #3115 from oracle/oracle_oci_controller 
Cloud provider support for OCI (Oracle Cloud Infrastructure)
 2018-08-23 18:22:45 +02:00
Antoine Legrand
f59b80b80b
Merge pull request #3147 from ishitatsuyuki/etcd-cleanup 
gen_certs_script: refactor using stdin (Ansible 2.4+)
 2018-08-23 18:19:28 +02:00
rongzhang
7b61a0eff0 Fix kubeadm LB configure 
1. join node add LB discoveryTokenAPIServers
2. kubeadm_config_api_fqdn support ipddress and domain_name
 2018-08-23 22:22:34 +08:00
Aivars Sterns
23fd3461bc calico upgrade to v3 (#3086) 
* calico upgrade to v3

* update calico_rr version

* add missing file

* change contents of main.yml as it was left old version

* enable network policy by default

* remove unneeded task

* Fix kubelet calico settings

* fix when statement

* switch back to node-kubeconfig.yaml
 2018-08-23 17:17:18 +03:00
msimonin
e22e15afda
Fix createhome directory for adduser role 
A typo in the adduser role prevents the createhome
variable to be taken into account.

Fix #3164
 2018-08-23 08:55:11 +02:00
Rong Zhang
f453567cce
Merge pull request #3144 from riverzhang/fix-audit-log 
Fix install audit failed
 2018-08-23 14:41:37 +08:00
Tatsuyuki Ishi
69786b2d16 gen_certs_script: refactor using stdin (Ansible 2.4+) 2018-08-23 11:19:17 +09:00
rongzhang
5a4352657d Fix install audit failed 
1.fix audit log not write
2.fix Parameter not recognized
3.delete kubedm futuregates auditing and use apiServerExtraArgs
 2018-08-23 01:47:15 +08:00
Samuele Chiocca
f13bc796d9 added nodePortAddresses on kubeadm conf v1alpha2 (not present on v1alpha1) 2018-08-22 18:43:03 +02:00
Erwan Miran
a6a14e7f77 create the service account and roles even if the rbac is not enabled. it will just be ignored 2018-08-22 18:17:11 +02:00
Erwan Miran
80cfeea957 psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-22 18:16:13 +02:00
ant31
2c90208486 Fix docker apt-repo for Ubuntu18 2018-08-22 15:53:14 +00:00
Antoine Legrand
4eea7f7eb9
Merge pull request #3152 from johnzheng1975/cilium_1.2.0 
new cilium stable version: 1.2.0
 2018-08-22 17:11:42 +02:00
Samuele Chiocca
5d9908c2c3 --nodeport-addresses added on kube-proxy.manifest.j2 
Changed author
 2018-08-22 15:32:07 +02:00
Erwan Miran
a7b0c454db Localhost in hosts files should be updated (if necessary), not overriden 2018-08-22 12:10:49 +02:00
Wong Hoi Sing Edison
c3b3572025 Always create service account even rbac_enabled = false 2018-08-22 11:41:29 +08:00
Wong Hoi Sing Edison
f897596844 Remove *_image_tag suffix from ReplicaSet/Deployment 2018-08-22 11:02:56 +08:00
john
6df71956c4 new cilium stable version: 1.2.0 2018-08-22 10:52:24 +08:00
Jeff Bornemann
94df70be98 Cloud provider support for OCI (Oracle Cloud Infrastructure) 
Signed-off-by: Jeff Bornemann <jeff.bornemann@oracle.com>
 2018-08-21 17:36:42 -04:00
Mark Eisenblaetter
0c0a2138d9 allow '.' in hostnames 
we use FQDN as inventory_hostname
 2018-08-21 08:24:33 +02:00
Jonathan Craig
5bf152886b add support for openstack trust to cloud provider config 2018-08-20 12:51:25 -04:00
Andreas Krüger
497db69c9f
Merge pull request #3130 from riverzhang/add-control-plane 
Add kubeadm controlplaneEndpoint
 2018-08-20 10:43:50 +02:00
Andreas Krüger
c7de737551
Merge pull request #3133 from mirwan/auditlog_to_stdout_w_kubeadm 
Audit log to stdout with kubeadm
 2018-08-20 10:43:22 +02:00
Andreas Krüger
69749a5b7b
Merge pull request #3132 from mirwan/custom_audit_policy 
Custom audit policy
 2018-08-20 10:42:38 +02:00
Andreas Krüger
b3e32c1393
Merge pull request #3094 from hedayat/master 
Add --dns-loop-detect to dnsmasq used in kube-dns
 2018-08-20 09:27:15 +02:00
Erwan Miran
fc38b6d0ca Ability to define custom audit polcy rules 2018-08-20 07:04:56 +02:00
Erwan Miran
c34900e569 Define apiserver flags directly instead of relying on auditPolicy section in order to have the ability to redirect audit log to stdout with kubeadm 2018-08-20 07:00:53 +02:00
Rong Zhang
855f2a55cb
Merge pull request #3135 from ishitatsuyuki/patch-1 
Add bad hostname preflight check
 2018-08-20 12:08:02 +08:00
Wong Hoi Sing Edison
71fdc257bc cephfs-provisioner: Upgrade to v2.0.1-k8s1.11 2018-08-20 11:55:04 +08:00
Rong Zhang
fd16f77e20
Merge pull request #3017 from seungkyua/fix_kubeadm_client_conf 
Fix kubeadm client conf
 2018-08-20 10:51:02 +08:00
Tatsuyuki Ishi
3eef8dc8d0 Add bad hostname preflight check 
Hostname must be a valid DNS name, which is checked as https://github.com/kubernetes/apimachinery/blob/master/pkg/util/validation/validation.go#L115

The situation I have encountered is that my hostname contained underscore which is disallowed and apiserver refused to start.
 2018-08-20 09:09:00 +09:00
rongzhang
59176ebbb9 Add kubeadm controlplaneEndpoint 
Nginx LB(default)
Other LB by kubeadm controlplane
 2018-08-20 00:57:13 +08:00
rongzhang
b421d0ed5b Fix install nss 2018-08-20 00:07:31 +08:00
rongzhang
35efc387c4 Fix pull dns image error 2018-08-19 22:47:17 +08:00
Rong Zhang
fb309ca446
Merge pull request #3128 from riverzhang/delete-kubeadm 
Remove unused configuration
 2018-08-19 10:01:33 +08:00
Antoine Legrand
1d4f88eea8
Fix typo in image url 2018-08-19 01:30:54 +02:00
rongzhang
095ccef8bd Remove unused configuration 2018-08-19 01:23:20 +08:00
Rong Zhang
0df969ad19
Merge pull request #3117 from mirwan/audit_usecases 
Audit support improvement
 2018-08-19 01:13:22 +08:00
Antoine Legrand
3e5b6a5481
Merge pull request #3105 from mirwan/remove_cilium_device_at_reset_plus_move_network_to_network_plugin_roles 
Move network_plugin specific reset tasks to its role directory
 2018-08-17 22:27:16 +02:00
Antoine Legrand
c36744e96d
Merge pull request #3120 from alvistack/cephfs-provisioner-v2.0.0-k8s1.11 
cephfs-provisioner: Upgrade to v2.0.0-k8s1.11
 2018-08-17 22:11:15 +02:00
Antoine Legrand
e51c5dc0a6
Merge pull request #3123 from mathieuherbert/until-restart-etcd 
add until option for etcd backup commands
 2018-08-17 22:09:08 +02:00
Antoine Legrand
d297b82e82
Merge pull request #3126 from LuckySB/etcd_restart_on_update 
add etcd version to etcd environment file to trigger a reload
 2018-08-17 22:05:34 +02:00
Erwan Miran
98b818bbaf comply with ansible syntax consistency guideline 2018-08-17 16:37:33 +02:00
Antoine Legrand
26bf719a02
Merge branch 'master' into multi-arch-support 2018-08-17 16:35:50 +02:00
Antoine Legrand
7e37aa4aca
Merge pull request #2103 from xd007/docker_aarch64_pkg 
Update docker package info for aarch64
 2018-08-17 16:26:56 +02:00
Sergey Bondarev
ce6854e726 add version to environment file 
Trigger reboot handler when version upgrade during update script
 2018-08-17 17:25:35 +03:00
Antoine Legrand
ac49bbb336
Merge pull request #2168 from xd007/docker_arm64 
fix docker opts incompatible running on aarch64 Redhat/Centos
 2018-08-17 16:24:07 +02:00
Antoine Legrand
6c7eabb53b
Merge pull request #2001 from b0r1sp/patch-3 
Quote false and yes, otherwise they'll be transformed to 'False', 'Yes'
 2018-08-17 15:52:15 +02:00
Antoine Legrand
7a0f0126f7
Merge pull request #1295 from xuhuilong/master 
fix curl get calico status error ( error in tls version, centos 7.3 1611)
 2018-08-17 14:29:01 +02:00
Mathieu Herbert
59d89a37cc add until option for etcd backup commands 2018-08-17 11:05:57 +02:00
Wong Hoi Sing Edison
1a07c87af7 cephfs-provisioner: Upgrade to v2.0.0-k8s1.11 
Upstream Changes:

-   cephfs-provisioner v2.0.0-k8s1.11 (https://github.com/kubernetes-incubator/external-storage/releases/tag/cephfs-provisioner-v2.0.0-k8s1.11)
-   Update ClusterRole

Our Changes:

-   Fix typo in defaults/main.yml (rs -> deploy)
-   Manifests cleanup
 2018-08-17 12:41:56 +08:00
Seungkyu Ahn
29894293eb Fix kubeadm client conf 
Fix DiscoveryTokenCACertHashes key to discoveryTokenCACertHashes in kubeadm-client.conf
 2018-08-17 04:40:08 +00:00
Jonathan Craig
4d783fff0d resolve issues with new cacert feature 2018-08-16 23:31:21 -04:00
Erwan Miran
7f16b46ed5 Reset tasks specific to a network_plugin moved inside its role directory + Reset tasks specific to cilium 2018-08-16 17:34:33 +02:00
Antoine Legrand
58ee5f1cc9
Merge pull request #3089 from mattymo/cloudconfig 
Remove erroneous cloud-config task
 2018-08-16 16:17:01 +02:00
Antoine Legrand
253dc4f606
Merge pull request #3114 from woopstar/coredns-1.2.0 
Update CoreDNS to 1.2.0
 2018-08-16 16:14:13 +02:00
Erwan Miran
54548d3b95 kubeadm mounts the hostpaths itself 2018-08-16 13:17:30 +02:00
Erwan Miran
58d4d65fab minor variable fix and reuse + handle auditlog redirected to stdout 2018-08-16 12:51:09 +02:00
Rong Zhang
364ab2a6b7
Merge pull request #3113 from riverzhang/support-audit 
Support audit
 2018-08-16 15:33:43 +08:00
rongzhang
2ffc1afe40 Support audit 2018-08-16 14:38:07 +08:00
Wong Hoi Sing Edison
18612b3501 cert-manager: Upgrade to 0.4.1 
Upstream Changes:

-   cert-manager 0.4.1 (https://github.com/jetstack/cert-manager/releases/tag/v0.4.1)

Our Changes:

-   Better templates sync with upstream manifests
-   Remove fancy resources requests/limits customization
 2018-08-16 08:47:01 +08:00
Andreas Kruger
9da5d67728 Update CoreDNS to 1.2.0 2018-08-15 13:39:05 +02:00
Wong Hoi Sing Edison
bd413e36a3 ingress-nginx: Upgrade to 0.18.0 
Upstream Changes:

-   ingress-nginx 0.18.0 (https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.18.0)
 2018-08-15 11:40:42 +08:00
Chad Swenson
2c5781ace1
Merge pull request #2932 from wiremind/efk-fluentd-no-nodeselector 
fluentd daemonset: do not set old nodeSelector.
 2018-08-14 13:48:30 -05:00
JohnZheng
b50b3430be Disable locksmithd on CoreOS if coreos_auto_upgrade set to false (#3088) 
* Disable locksmithd on CoreOS if coreos_auto_upgrade set to false

* change when format to support multiple-condition
 2018-08-14 13:42:16 -05:00
Chad Swenson
0e3518f2ca
Merge pull request #2871 from fritchie/lptolerate 
Local volume provisioner: tolerate NoSchedule
 2018-08-14 13:39:57 -05:00
Chad Swenson
3a85a2f81c
Merge pull request #3080 from mirwan/netchecker_template_rendering_filename 
Netchecker manifests should not have j2 extension
 2018-08-14 13:24:16 -05:00
Chad Swenson
5dbfa0384e
Merge pull request #3101 from chenhonggc/uninstall_old_versions_of_docker 
Uninstall old versions of Docker
 2018-08-14 11:32:23 -05:00
rongzhang
48b6128814 Upgrade coredns to 1.1.3 2018-08-15 00:05:55 +08:00
Maxime Brunet
70b28288a3 Use delegate_to: localhost instead of local_action 
Allow to use `ansible_become: true` (#2969)
And set it to `false` for `localhost` with an `host_var`
 2018-08-14 10:08:43 -04:00
Rong Zhang
a11e1eba9e Upgrade kubernetes to V1.11.x (#3078) 
Upgrade Kubernetes to V1.11.2
The kubeadm configuration file version has been upgraded from v1alpha1 to v1alpha2
Add bootstrap kubeadm-config.yaml with external etcd
 2018-08-14 15:13:44 +03:00
Chen Hong
2dfa928c90 Uninstall old versions of Docker 2018-08-14 17:48:30 +08:00
Erwan Miran
d3c0fe1fcb Templates (even without actual templating inside) should have j2 extension but should not be rendered with j2 extension 2018-08-13 09:51:26 +02:00
Hedayat Vatankhah
c0221c2e72 Add --dns-loop-detect to dnsmasq used in kube-dns 
It prevents DNS loops when host's DNS server is a localhost DNS server,
or when DNS server of cluster is also added as an upstream DNS server
 2018-08-12 20:36:33 +04:30
mauromedda
9cef20187c Add the path to kubectl binary 
The post-remove action fails during the kubectl delete node action because with rc: 2, command not found. The kubectl is not in the system PATH and the full path to the binary is required
 2018-08-12 10:50:50 +02:00
Anton Fayzrahmanov
95f1e4634a local-volume-provisioner: use mountPropagation HostToContainer and version bump (#3081) 
* Update local-volume-provisioner-ds.yml.j2

After v1.10.2 default mountPropagation is "None"

* local_volume_provisioner version bump

v2.1.0 uses the beta nodeAffinity API by default which is available starting 1.10

* Update local-volume-provisioner-ds.yml.j2

MY_NAMESPACE env

* Update README.md

Raw block devices docs.
 2018-08-10 17:14:34 +03:00
Matthew Mosesohn
581a30fdec Remove erroneous cloud-config task 2018-08-10 15:59:18 +03:00
Andreas Krüger
d8e77600e2
Merge pull request #3066 from luisyonaldo/fix-conditional 
fix bad conditional
 2018-08-10 10:38:52 +02:00
Cédric de Saint Martin
e3dcd96301 kubedns & kubedns-autoscaler: Stick to master nodes. (#2909) 
* kubedns & kubedns-autoscaler: Stick to master nodes.

 - Tolerate only master nodes and not any NoSchedule taint
 - Pods are on different nodes
 - Pods are required to be on a master node.

* kubedns: use soft nodeAffinity.

Prefer to be on a master node, don't require.

* coredns: Stick to (different) master nodes.

     - Pods are on different nodes
     - Pods are preferred to be on a master node.
 2018-08-09 10:42:53 -05:00
Chad Swenson
001cae5894
Merge pull request #3028 from Kami-no/cilium 
cilium v1.1.2
 2018-08-09 10:35:29 -05:00
Erwan Miran
494ff9522b j2 extension should only be used for template filename, not target file on remote host 2018-08-09 11:29:45 +02:00
Luis Nuñez
fd380615a0 fix bad conditional 2018-08-09 10:20:45 +02:00
Rong Zhang
039180b2ca
Merge pull request #3022 from alvistack/weave-2.4.0 
weave: Upgrade to 2.4.0
 2018-08-09 15:01:05 +08:00
Zinin D.A
22b89edbbc cilium v1.1.2 
Update all configs to current upstream state.
Add more resources (unable to pass tests now)...
 2018-08-08 22:42:50 +03:00
Rong Zhang
94ae945bea
Merge pull request #2904 from mirwan/var_lib_kubelet_should_not_be_unmounted_when_having_its_own_partition 
Only subdirectories in /var/lib/kubelet should be unmounted at reset time
 2018-08-08 15:00:54 +08:00
Rong Zhang
5c039d87aa
Merge pull request #3054 from reverson/1.10-admission 
Add support for admission controllers in 1.10 and above
 2018-08-08 14:32:11 +08:00
Rong Zhang
08dfb7b59f
Merge pull request #3073 from riverzhang/delete-istio 
Remove istio support
 2018-08-08 13:00:57 +08:00
rongzhang
ea6af449a8 Remove istio support 
Use helm install or support in future
 2018-08-08 11:10:09 +08:00
Mathieu Herbert
d285565475 Add tags for coredns and kubedns 2018-08-07 20:55:38 +02:00
Robert Everson
4eadf3228e Only add admission plugins if defined 2018-08-07 11:25:03 -07:00
Robert Everson
99c5aa5a02 Use k8s default plugin list 2018-08-07 11:25:03 -07:00
Robert Everson
6ed65d762b Separate out plugins into 2 variables 2018-08-07 11:25:03 -07:00
Robert Everson
ac18f6cf8b Add support for admission controllers in 1.10 and above 2018-08-07 11:25:03 -07:00
Rong Zhang
e71f261935
Merge pull request #3068 from riverzhang/swap 
Enable swap
 2018-08-07 21:29:41 +08:00
rongzhang
b902602d16 Enable swap 2018-08-07 21:13:12 +08:00
Wong Hoi Sing Edison
538cb3b1bd weave: Upgrade to 2.4.0 
Upstream Changes:

-   weave 2.4.0 (https://github.com/weaveworks/weave/releases/tag/v2.4.0)
-   Support `externalTrafficPolicy: Local` (https://github.com/weaveworks/weave/issues/2924)
-   Make the ipset list size bigger (https://github.com/weaveworks/weave/pull/3305)
-   Break out of kube rm-peers loop if nothing changes (https://github.com/weaveworks/weave/pull/3317)

Our Changes:

-   Revamp weave-net.yml.j2 with upstream changes
-   Add more variables for customization
-   Replace WEAVE_PASSWORD with k8s secret
-   Remove hard-corded seed mode support, in favor of variables customization
 2018-08-07 18:34:51 +08:00
Wong Hoi Sing Edison
17e335c6a7 ingress-nginx: Upgrade to 0.17.1 
Upstream Changes:

-   ingress-nginx 0.17.1 (https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.17.1)
-   Remove duplicated `securityContext` (https://github.com/kubernetes/ingress-nginx/pull/2705)
-   Remove --publish-service flag, in favor of DaemonSet + hostPort

Close #2998
Close #2999
 2018-08-07 18:31:08 +08:00
Rong Zhang
280d6cac1a
Merge pull request #2997 from alvistack/cert-manager-0.4.0 
cert-manager: Upgrade to 0.4.0
 2018-08-07 18:00:46 +08:00
Rong Zhang
c288ffc55d
Merge pull request #2342 from southquist/add-ca-cert 
allow for setting the cacert on openstack cloud provider
 2018-08-07 17:46:01 +08:00
Rong Zhang
9075dbdd3c
Merge pull request #2875 from bradbeam/movault 
Adding cluster_name to api cert alt name for vault
 2018-08-07 17:36:04 +08:00
Rong Zhang
7850bce254
Merge pull request #2994 from DBLaci/master 
dashboard_token_ttl option override possibility with default
 2018-08-07 17:16:25 +08:00
Rong Zhang
3d19e03294
Merge pull request #3015 from podnov/kube_proxy_healthz_bind_address 
Variablize kube_proxy_healthz_bind_address
 2018-08-07 17:10:33 +08:00
Rong Zhang
b1f8bfdf7c
Merge pull request #3055 from reverson/17.09-docker 
Add support for docker 17.09
 2018-08-07 16:57:50 +08:00
Wong Hoi Sing Edison
0f400a113c cert-manager: Upgrade to 0.4.0 
Upstream Changes:

-   cert-manager 0.4.0 (https://github.com/jetstack/cert-manager/releases/tag/v0.4.0)
 2018-08-07 14:29:28 +08:00
Aleksey Shirokih
e8447e3d71
Service file binary place mismatch 
According to cluster/binary.yml vault binary will be placed to `{{ bin_dir }}` and according to `inventory/sample/group_vars/all.yml` that is 
`inventory/sample/group_vars/all.yml`
 2018-08-06 14:44:13 +03:00
rongzhang
ac644ed049 Fix yaml roles error 2018-08-05 18:48:07 +08:00
Rong Zhang
453fea1977
Merge pull request #3034 from cornelius-keller/library_fix 
fix missing libraries on newer coreos versions
 2018-08-05 12:54:03 +08:00
cornelius-keller
4b5cb1185f fix missing libraries on newer coreos versions 2018-08-03 15:29:05 +02:00
Robert Everson
275cdc1ce3 Add support for docker 17.09 2018-08-02 11:35:16 -07:00
DBLaci
d43f09081e
Merge pull request #1 from kubernetes-incubator/master 
Follow upstream
 2018-08-01 16:34:10 +02:00
woosley.xu
72074f283b set local for growpart part 2 2018-07-31 06:56:09 +08:00
woosley.xu
a5db3dbea9 set locale for growpart 2018-07-31 06:52:56 +08:00
Alexandre Ardhuin
9b349a9049 Fix label of registry in README 2018-07-27 11:42:21 +02:00
Seungkyu Ahn
0366600b45 Remove double slash 
Even without this PR, the operation works well.
However, it is better to use a single slash rather than
a double slash in the path.
 2018-07-20 07:34:33 +00:00
Evan Zeimet
6a4ce96b7d Variablize kube_proxy_healthz_bind_address 
This fixes #3014
 2018-07-19 14:19:09 -05:00
DBLaci
b61c64a8ea token-ttl default value is int in seconds 2018-07-19 12:15:47 +02:00
Takashi Okamoto
37ccf7e405 Fixed kubectl path. 2018-07-13 15:32:08 +00:00
DBLaci
cb91003cea dashboard_token_ttl option override possibility with default 2018-07-13 15:26:18 +02:00
Matthew Mosesohn
97e0de7e29
Fix vault file owner issues and k8s apiserver cert creation (#2985) 
apiserver cert should be created only once
 2018-07-11 14:58:02 +03:00
Rong Zhang
cf445fd4fe
Merge pull request #2930 from alvistack/ingress-nginx-0.16.1 
ingress-nginx: Upgrade to 0.16.2
 2018-07-10 14:42:37 +08:00
Aivars Sterns
72f053d9bb
Merge pull request #2972 from mattymo/force_cni_cp 
Force copy cni files
 2018-07-10 09:40:10 +03:00
Wong Hoi Sing Edison
a0defefb3f ingress-nginx: Upgrade to 0.16.2 
ingress-nginx 0.16.2 (https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.16.2)

This patch simplify ingress-nginx deployment by default deploy on
master, with customizable options; on the other hand, remove the
additional Ansible group "kube-ingress" and its k8s node label
injection.

Reference to https://kubernetes.io/docs/concepts/services-networking/ingress/#prerequisites:

    GCE/Google Kubernetes Engine deploys an ingress controller on the master.

By changing `ingress_nginx_nodeselector` plus custom k8s node
label, user could customize the DaemonSet deployment target.

If `ingress_nginx_nodeselector` is empty, will deploy DaemonSet on
every k8s node.
 2018-07-10 12:26:06 +08:00
Wong Hoi Sing Edison
62b1166911 cert-manager: Upgrade to 0.3.2 
Upstream Changes:

-   cert-manager 0.3.2 (https://github.com/jetstack/cert-manager/releases/tag/v0.3.2)

Our Changes:

-   Remove legacy addon dir, manifests and namespace before upgrade
 2018-07-10 08:48:44 +08:00
Rong Zhang
810596c6d8
Merge pull request #2974 from alvistack/cephfs-provisioner-1.1.0-k8s1.10 
cephfs-provisioner: Upgrade to 1.1.0-k8s1.10
 2018-07-09 13:53:07 +08:00
Rong Zhang
a488d55c2c
Merge pull request #2975 from daohoangson/remove_force_disable_kube_basic_auth 
Remove step that disables `kube_basic_auth`.
 2018-07-08 21:18:36 +08:00
Alexandru Bogdan Pica
e63bc65a9d Fix 2976 
Fix failure when the container attribute is not set for a download
 2018-07-08 13:36:47 +03:00
Dao Hoang Son
d306c9708c Remove step that force disable kube_basic_auth. 
The referenced issue (https://github.com/kubernetes/kubeadm/issues/441) has already been fixed.
 2018-07-08 16:57:43 +07:00
Wong Hoi Sing Edison
6a65345ef3 cephfs-provisioner: Upgrade to 1.1.0-k8s1.10 
Upstream Changes:

-   Update CEPH_VERSION to mimic (https://github.com/kubernetes-incubator/external-storage/pull/841)

Our Changes:

-   Using image from official repo which contain latest changes (https://quay.io/repository/external_storage/cephfs-provisioner)
 2018-07-08 00:37:08 +08:00
Matthew Mosesohn
1a3b9dd864 Force copy cni files 2018-07-06 16:39:42 +03:00
elementyang
8fee1ab102 change create to apply 2018-07-06 19:36:19 +08:00
Matthew Mosesohn
5c617c5a8b
Add tags to deploy components by --tags option (#2960) 
* Add tags for cert serial tasks

This will help facilitate tag-based deployment of specific components.

* fixup kubernetes node
 2018-07-06 09:12:13 +03:00
Matthew Mosesohn
0b939a495b
Improve vault etcd initialization check (#2959) 2018-07-05 12:27:45 +03:00
elementyang
5a4f07adca change the way of getting etcd_member_name 2018-07-05 00:06:37 +08:00
Aivars Sterns
4092f96dd8
Merge pull request #2946 from Miouge1/remove-pid-predicate 
CheckNodePIDPressure is not supported in v1.10
 2018-07-04 18:30:19 +03:00
elementyang
effd27a5f6 change the way that getting etcd_member_name 2018-07-03 22:02:44 +08:00
Rong Zhang
77c870b7d0
Merge pull request #2951 from alvistack/cephfs-provisioner-06fddbe2 
cephfs-provisioner: Upgrade to 06fddbe2
 2018-07-03 19:36:42 +08:00
Rong Zhang
32a6ca4fd6
Merge pull request #2948 from qeqar/remove-node-limit 
move node selection from --limit to --extra-vars=node<nodename>"
 2018-07-03 18:41:57 +08:00
Wong Hoi Sing Edison
728024e8ff cephfs-provisioner: Upgrade to 06fddbe2 
-   cephfs-provisioner 06fddbe2 (https://github.com/kubernetes-incubator/external-storage/tree/06fddbe2/ceph/cephfs)

Noteable changes from upstream:

-   Added storage class parameters to specify a root path within the backing cephfs and, optionally, use deterministic directory and user names (https://github.com/kubernetes-incubator/external-storage/pull/696)
-   Support capacity (https://github.com/kubernetes-incubator/external-storage/pull/770)
-   Enable metrics server (https://github.com/kubernetes-incubator/external-storage/pull/797)

Other noteable changes:

-   Clean up legacy manifests file naming
-   Remove legacy manifests, namespace and storageclass before upgrade
-   `cephfs_provisioner_monitors` simplified as string
-   Default to new deterministic naming
-   Add `reclaimPolicy` support in StorageClass

With legacy non-deterministic naming style (where $UUID are generated ramdonly):

-   cephfs_provisioner_claim_root: /volumes/kubernetes
-   cephfs_provisioner_deterministic_names: false
-   Generated CephFS volume: /volumes/kubernetes/kubernetes-dynamic-pvc-$UUID
-   Generated CephFS user: kubernetes-dynamic-user-$UUID

With new default deterministic naming style (where $NAMESPACE and $PVC are predictable):

-   cephfs_provisioner_claim_root: /volumes
-   cephfs_provisioner_deterministic_names: true
-   Generated CephFS volume: /volumes/$NAMESPACE/$PVC
-   Generated CephFS user: k8s.$NAMESPACE.$PVC
 2018-07-03 10:15:24 +08:00
Mark Eisenblaetter
b548f6f320 move node selection from --limit to --extra-vars=node<nodename>" 2018-07-02 20:04:36 +02:00
Nicolas Trangez
8bcad4f5ef Fix coreos_dual -> coredns_dual typo 
See: e40368ae2b
 2018-07-02 17:19:35 +02:00
Rong Zhang
31e6c44b07
Merge pull request #2924 from elementyang/make-ssl-etcd-pr 
fix the time of ca files are changed in make-ssl-etcd
 2018-07-02 20:44:20 +08:00
Matthew Mosesohn
77c910c1c3
Fixup vault etcd check (#2938) 
* Fixup vault etcd

* Update main.yml
 2018-07-02 15:37:37 +03:00
Matthew Mosesohn
c20196f9a0
Remove modprobe binary from kubelet rkt deployment (#2917) 2018-07-02 15:37:24 +03:00
Rong Zhang
f6a15b1829
Merge pull request #2918 from elementyang/fix-pr 
fix add etcd_events_access_address
 2018-06-30 11:55:38 +08:00
elementyang
7c22def422 add etcd_events_access_address 2018-06-30 07:32:29 +08:00
Rong Zhang
87e49f0055
Merge pull request #2921 from elementyang/index-out-of-range-pr 
fix template index out of range for pull images
 2018-06-30 00:53:53 +08:00
Matthew Mosesohn
a36e3fbec3
Add rkt gc task (#2945) 2018-06-29 19:53:21 +03:00
Miouge1
2a279e30b0 CheckNodePIDPressure is not supported in v1.10 2018-06-28 20:10:38 +02:00
southquist
c685dc493f allow for setting the cacert on openstack cloud provider 2018-06-28 16:00:13 +02:00
Andreas Krüger
e24f888bc4
Merge pull request #2923 from bradbeam/vaultrkt 
Adding uuidfile for rkt based vault to properly cleanup after itself
 2018-06-27 11:18:39 +02:00
Cédric de Saint Martin
a260412c7e fluentd daemonset: do not set arbitrary nodeSelector. 2018-06-25 15:19:56 +02:00
neith00
a643f72d93 No need to install rkt on CoreOS 2018-06-25 09:38:24 +02:00
Aivars Sterns
73a2a18006
Merge pull request #2795 from gfkse/baremetal-override-calico-hostname 
Make Calico nodename overridable on bare metal
 2018-06-25 08:45:09 +03:00
Rong Zhang
2ef05fb3b7
Merge pull request #2763 from ameukam/update_efk_stack 
Update efk stack
 2018-06-24 19:01:32 +08:00
Rong Zhang
e06d02365e
Merge pull request #2338 from southquist/template-openstack-storage-class 
allow for configurable openstack storage class
 2018-06-24 18:42:29 +08:00
elementyang
d6f2dbc723 fix the time of ca files are changed in make-ssl-etcd 2018-06-24 13:05:43 +08:00
Brad Beam
20dba8b388 Adding uuidfile for rkt based vault to properly cleanup after itself 2018-06-23 15:14:40 -05:00
Rong Zhang
f624ba47fb
Merge pull request #2922 from riverzhang/remove-node 
Add run_once to remove-node
 2018-06-23 15:09:16 +08:00
rongzhang
94aa062d51 Add run_once to remove-node 2018-06-23 07:05:24 +00:00
elementyang
c0935e161b fix template index out of range for pull images 2018-06-23 05:32:44 +08:00
elementyang
70fbc01cc1 fix etcd_events_access_addresses 2018-06-23 00:04:19 +08:00
Yumo Yang
6c2f169ea2 update test-pr2 (#2911) 2018-06-22 13:22:26 +03:00
Rong Zhang
1aee6ec371
Merge pull request #2903 from riverzhang/swap 
Add manage swap on the worker node
 2018-06-21 22:20:23 +08:00
Erwan Miran
d3fdfee211 Only subdirectories in /var/lib/kubelet should be unmounted 2018-06-21 11:50:02 +02:00
rongzhang
3232e2743e Add manage swap on the worker node 2018-06-21 08:15:01 +00:00
Andreas Krüger
cbb959151c
Merge pull request #2737 from Miouge1/update-scheduler 
Update kube-scheduler policy
 2018-06-19 14:53:22 +02:00
Andreas Krüger
c3d8b131db
Merge pull request #2801 from dvazar/bugfix/undefined__network_plugin__variable 
Fixed "network_plugin" variable
 2018-06-19 10:01:06 +02:00
Andreas Krüger
236d1a448d
Merge pull request #2898 from kubernetes-incubator/default_true_authtoken 
Enable by default the kubelet token auth
 2018-06-19 09:56:32 +02:00
Matthew Mosesohn
61e97251a5 Improve variable handling for disabling etcd events cluster 2018-06-18 16:58:29 +03:00
Antoine Legrand
c192a01b20 Enable by default the kubelet token auth 2018-06-18 14:20:05 +02:00
Henry Finucane
3ad9e9c5eb Fix #2261 by supporting Red Hat's limited PATH 
Red Hat has this theory that binaries in sbin are too dangerous to be on
the default path, but we need them anyway.

RH7 has /sbin and /usr/sbin as symlinks, so that is no longer important.

I'm adding it to the `PATH` instead of making the path to `modinfo`
absolute because I am worried about breaking support for other
distributions.
 2018-06-15 12:49:22 -07:00
Julien Mailleret
6aaaf4a272 Limit the maximum number of revisions saved per helm release (#2894) 
* Limit the maximum number of revisions saved per helm release
 2018-06-15 12:50:18 +02:00
Andreas Krüger
cd64f41524
Merge pull request #2844 from chechiachang/fix-inconsistent-variable-in-task-name-and-msg 
Fix inconsistent variables in task name and task message
 2018-06-15 09:19:31 +02:00
Andreas Krüger
df279b1ff6
Merge pull request #2890 from drekle/bugfix/dns-domain-incorrect-for-coredns 
CoreDNS uses cluster_name instead of dns_domain
 2018-06-15 09:06:11 +02:00
Andreas Krüger
6ac601fd2d
Merge pull request #2876 from neith00/docker_iptables 
parametrized iptables options for docker daemon
 2018-06-14 22:23:27 +02:00
Andreas Krüger
3a569c9dcb
Merge pull request #2750 from w-leads/feature/add-vmname-to-vcp-config 
Add vm_name option to vsphere cloud provider config
 2018-06-14 22:22:34 +02:00
neith00
f2f1e7f9d1 parametrized iptables options for docker daemon 2018-06-14 12:16:16 +02:00
Rong Zhang
0686b8452e
Merge pull request #2860 from alvistack/cert-manager-0.3.0 
cert-manager: Upgrade to v0.3.0
 2018-06-14 10:35:23 +08:00
Derek Lemon
1e98e8444e Using dns domain instead of cluster name for coredns, incase they differ 2018-06-13 18:52:35 +00:00
Wong Hoi Sing Edison
291dd1aca8 Fixup #2545, cephfs-provisioner: Individual Namespace for Add-on 2018-06-13 21:52:58 +08:00
Wong Hoi Sing Edison
38da0adead cert-manager: Upgrade to v0.3.0 2018-06-13 21:47:44 +08:00
Rong Zhang
81b3343796
Merge pull request #2857 from alvistack/ingress-nginx-0.15.0 
ingress-nginx: Upgrade to 0.15.0
 2018-06-13 21:16:17 +08:00
Brad Beam
3d819a6edd Adding cluster_name to api cert alt name for vault 2018-06-12 14:15:07 -05:00
rongzhang
20bd656975 Reconfigure kube-proxy to access kube-apiserver via the LB(kubeadm) 2018-06-12 12:53:50 +00:00
Frank Ritchie
cfe939ff08 Tolerate NoSchedule by default 2018-06-11 20:10:13 -04:00
Wong Hoi Sing Edison
9f245dd9b2 ingress-nginx: Upgrade to 0.15.0 2018-06-08 16:05:15 +08:00
Rong Zhang
10c9fe96b0
Merge pull request #2859 from riverzhang/nginx 
Fix nginx-proxy HA when kubeadm enable
 2018-06-08 01:10:01 +08:00
Rong Zhang
42b24616ac
Merge pull request #2856 from alvistack/kubernetes-1.10.4 
Upgrade Kubernetes to 10.0.4 and etcd to 3.2.18
 2018-06-07 23:54:03 +08:00
rongzhang
f9ccb93825 Fix nginx-proxy HA when kubeadm enable 2018-06-07 14:27:19 +00:00
Aivars Sterns
daeea75fbb
Merge pull request #2835 from oracle/bm_fix-apiserver-access-ip 
roles/kubernetes/client: kubeconfig template should use access_ip
 2018-06-07 11:50:57 +03:00
Wong Hoi Sing Edison
0ad0202e8f Upgrade Kubernetes to 10.0.4 and etcd to 3.2.18 2018-06-07 16:20:29 +08:00
Brad Beam
1f02cc70f1
Merge pull request #2825 from dshuvar/dshuvar/docker-options.conf 
Changed /etc/systemd/system/docker.service.d/docker-options.conf file for successful parsing mount aguments
 2018-06-06 12:56:18 -05:00
Brad Beam
fe010504aa
Merge pull request #2851 from bradbeam/vaultnotify 
Adding wait for vault up handler in service restart
 2018-06-06 12:49:03 -05:00
Brad Beam
63a458063b Adding missing rkt template for etcd-events 2018-06-06 10:43:30 -05:00
Brad Beam
a8715f9f0f Adding wait for vault up handler in service restart 2018-06-06 10:40:27 -05:00
Matthew Mosesohn
59be578842
Revert "wip pr for improved cert sync" (#2849) 2018-06-06 17:22:25 +03:00
Aivars Sterns
cb0a257349
Merge pull request #2819 from oleh-ozimok/fix-cidr-assert 
Fix enough network address space assert
 2018-06-06 07:32:16 +03:00
Di Xu
1081f620d2 add support for non-amd64 arch gcr.io images 
Currently all the gcr.io images used in kubespray can only run on x86.
Also gcr.io has not fully support multi-arch docker images.

Add extra var "image_arch" (default is amd64) to support running other
platforms, like arm64.

Change-Id: I8e1c9af533c021cb96ade291a1ce58773b40e271
 2018-06-05 17:29:02 +08:00
David Chang
e1cfe83825 Fix inconsistent variables in task name and task message 2018-06-05 16:45:02 +08:00
Di Xu
6019a84fb3 Update docker package info for aarch64 
Missing corresponding package docker-engine on aarch64, use docker instead.

Change-Id: If5df58337746a81752b5d477e0473600eaee8381
 2018-06-05 16:30:28 +08:00
Di Xu
f4d762bb95 fix docker opts incompatible running on aarch64 Redhat/Centos 
On Aarch64, the default cgroup driver for docker is systemd
instead of cgroupfs. Should conform kubelet to use systemd
as cgroup driver as well to keep it consistent with docker.

Without this change, below exception will be raised.
/usr/bin/docker-current: Error response from daemon: shim
error: docker-runc not installed on system.

Change-Id: Id496ec9eaac6580e4da2f3ef1a386c9abc2a5129
 2018-06-05 16:17:16 +08:00
Aivars Sterns
69ea28e187
Merge pull request #2827 from mattymo/testpr 
wip pr for improved cert sync
 2018-06-04 12:43:00 +03:00
Ben Meier
2f5a9e180c kubernetes/client: kubeconfig template should use the access_ip for the chosen master node 2018-06-04 09:51:05 +01:00
Dmitry
f912a4ece5 Fix compare AnsibleUnsafeText with int (#2828) 2018-06-04 11:34:10 +03:00
Rong Zhang
d1e66f9cc8 Add label to kubelet env for kubeadm deploy cluster (#2841) 2018-06-04 11:26:47 +03:00
Aivars Sterns
b67cf74c5e
Merge pull request #2823 from scality/dashboard_in_cluster_info 
Dashboard in cluster info
 2018-05-31 15:48:25 +03:00
Erwan Miran
11d87ecc37 removed surnumerary definition of contiv_etcd_init_image_* (already in download role) 2018-05-31 00:02:11 +02:00
Matthew Mosesohn
7433348aae wip pr for improved cert sync 2018-05-30 12:15:11 +03:00
Erwan Miran
3673ed6262 include contiv_etcd_init_image to downloads role 2018-05-29 17:05:33 +02:00
Dmitrii Shuvar
16f860bbc2
Update docker-options.conf.j2 
Changed /etc/systemd/system/docker.service.d/docker-options.conf file for successful parsing mount aguments
try fix ci error previous commit
 2018-05-29 12:40:33 +03:00
dshuvar
d973ecf5cc fix error message: '[/etc/systemd/system/docker.service.d/docker-options.conf:3] Failed to parse mount flag , ignoring.' 2018-05-28 18:23:15 +03:00
Julien Girardin
f88cd27686 Add dashboard url as part of kubectl cluster-info output 2018-05-28 11:46:11 +02:00
Erwan Miran
2a4fc70e1c contiv-etcd-init image as default instead hardcoded 2018-05-28 11:11:18 +02:00
Oleg Ozimok
38f7ba2584 Fix enough network address space assert 2018-05-27 18:01:17 +03:00
dvazar
b3f9cae820 fixed a check unknown networks (cilium & contiv) 2018-05-22 16:43:19 +07:00
Andreas Krüger
a67bdff28c
Merge pull request #2743 from mrostecki/opensuse-tumbleweed-openssl 
opensuse: Fix OpenSSL package name
 2018-05-22 11:21:04 +02:00
Andreas Krüger
e3c8b230a0
Merge pull request #2806 from Miouge1/no-kpm 
Remove KPM support
 2018-05-22 11:17:52 +02:00
Miouge1
095d33bc51 Remove KPM support 2018-05-21 22:28:08 +02:00
Mikhail Vasilenko
821966b319 Update Helm version to 2.9.1 2018-05-21 17:36:51 +03:00
dvazar
4b8daa22f6 Fixes #2800 2018-05-19 00:57:09 +07:00
Andreas Krüger
e60a63ea51
Merge pull request #2577 from woopstar/etcd-fix-4 
Makeover of etcd- and etcd-cluster setup.
 2018-05-16 20:49:54 +02:00
Andreas Krüger
a2a7bcd43d
Merge pull request #2786 from cruwe/cjr-assert-maximum-pods-on-node-cidr 
assert that number of pods on node does not exceed CIDR address range
 2018-05-16 19:57:43 +02:00
Christopher J. Ruwe
c1bc4615fe assert that number of pods on node does not exceed CIDR address range 
The number of pods on a given node is determined by the  --max-pods=k
directive. When the address space is exhausted, no more pods can be
scheduled even if from the --max-pods-perspective, the node still has
capacity.

The special case that a pod is scheduled and uses the node IP in the
host network namespace is too "soft" to derive a guarantee.

Comparing kubelet_max_pods with kube_network_node_prefix when given
allows to assert that pod limits match the CIDR address space.
 2018-05-16 11:55:46 +00:00
Aivars Sterns
eba486f229 add posibility to provide different yum repository directory (#2787) 2018-05-16 13:56:04 +03:00
Andreas Krüger
4ac79993e2
Merge pull request #2666 from AnatolyRugalev/master 
Added MountFlags variable to docker options
 2018-05-16 09:34:34 +02:00
Matthew Mosesohn
7c93e71801
Upgrade k8s to 1.10.2 (#2748) 
* Upgrade k8s to 1.10.2

Bumped etcd version to 3.2.16 as recommended

* Add ipvs fix for v1.10

* change flannel addons test to ha
 2018-05-15 16:00:29 +03:00
Andreas Krüger
1be399ab7b
Merge pull request #2772 from cruwe/cjr-correct-perms-on-kubeconfig 
make admin.conf -> .kube/config non-executable
 2018-05-15 13:26:33 +02:00
Anatoly Rugalev
eae4fa040a Added docker_mount_flags option (fixes #2624) 2018-05-15 11:57:18 +02:00
Christopher J. Ruwe
73800ef111 make certificates non-executable 2018-05-15 07:54:32 +00:00
rongzhang
742a8782dd Bump kube-dns to 1.14.10 
Upgrade kube-dns to 1.14.10
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dns
 2018-05-15 03:29:10 +00:00
Arnaud Meukam
cd7c58e8d3 correct some indentation issues in the fluentd daemonset. 2018-05-14 19:56:18 +02:00
Daniel Mohr
476b14b06e Make Calico nodename overridable on bare metal 
Signed-off-by: Daniel Mohr <daniel.mohr@supercrunch.io>
 2018-05-14 14:13:51 +02:00
Christopher J. Ruwe
49d106f615 make admin.conf -> .kube/config non-executable 
Almost certainly, the .kube/config file (YAML) should not be executable.
 2018-05-14 09:29:48 +00:00
Miouge1
ad48606e4e Restart scheduler when policy changes 2018-05-14 10:09:30 +02:00
Arnaud Meukam
c75da43f22 add missing field in fluentd 2018-05-13 21:39:27 +02:00
Arnaud Meukam
65f14f636d remove support of other CRI runtimes than Docker in the efk stack 2018-05-13 18:37:36 +02:00
Arnaud Meukam
363627d9f8 serviceName added in elasticsearch. Required when a Statefulset is used 2018-05-13 14:23:37 +02:00
Arnaud Meukam
7950a49e28 update fluentd deployment and configmap 2018-05-11 18:56:14 +02:00
Arnaud Meukam
698da78768 update kibana docker image 2018-05-11 18:36:50 +02:00
Arnaud Meukam
ba320e918d update elasticsearch image 2018-05-11 18:22:44 +02:00
Matthew Mosesohn
07cc981971
refactor vault role (#2733) 
* Move front-proxy-client certs back to kube mount

We want the same CA for all k8s certs

* Refactor vault to use a third party module

The module adds idempotency and reduces some of the repetitive
logic in the vault role

Requires ansible-modules-hashivault on ansible node and hvac
on the vault hosts themselves

Add upgrade test scenario
Remove bootstrap-os tags from tasks

* fix upgrade issues

* improve unseal logic

* specify ca and fix etcd check

* Fix initialization check

bump machine size
 2018-05-11 19:11:38 +03:00
woopstar
7df5edef52 Fix path for pip and python 2018-05-11 16:01:52 +02:00
Cédric de Saint Martin
7507031cb1 CoreOS bootstrap: set bin_dir and PATH for pip. 2018-05-08 22:20:58 +02:00